Overview

overview

10

Static

static

SecuriteIn...70.rtf

windows7-x64

10

SecuriteIn...70.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SecuriteInfo.com.Exploit.CVE-2018-0798.4.6123.12270.rtf

  • Size

    3KB

  • Sample

    221207-symjmaad6y

  • MD5

    7a7d9b82e6d26b4d575ac0a5cd93faff

  • SHA1

    ce64d85889744473fa305c3e51cd50c58fb4a7ce

  • SHA256

    53dced2862d890b9c606cf475d09241f33dda53eb131af8a501ce1453b0aa56d

  • SHA512

    a08071efa1b27bb0d423d7b0670c8a6b1020dbf875a373676c4052e84b935d87a617ad77e1765117eb1883eb26ed43f88f3fe89de70c73661f9b721e6cda110c

Score
10/10
formbook8rmtratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

8rmt

Decoy

3472cc.com

takecareyourhair.com

kontolajigasd21.xyz

daihaitrinh.net

syncmostlatestinfo-file.info

lovesolutionsastrologist.info

angelapryan.com

rio727casino.com

jjsgagets.com

devyatkina.online

thegoldenbeautyqatar.com

czytaj-unas24live.monster

timepoachers.com

gayxxxporn.site

72308.xyz

kristanolivo.com

hijrahfwd.com

bmfighters.com

alfamx.website

handfulofbabesbows.com

Targets

    • Target

      SecuriteInfo.com.Exploit.CVE-2018-0798.4.6123.12270.rtf

    • Size

      3KB

    • MD5

      7a7d9b82e6d26b4d575ac0a5cd93faff

    • SHA1

      ce64d85889744473fa305c3e51cd50c58fb4a7ce

    • SHA256

      53dced2862d890b9c606cf475d09241f33dda53eb131af8a501ce1453b0aa56d

    • SHA512

      a08071efa1b27bb0d423d7b0670c8a6b1020dbf875a373676c4052e84b935d87a617ad77e1765117eb1883eb26ed43f88f3fe89de70c73661f9b721e6cda110c

    Score
    10/10
    formbook8rmtratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Formbook payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks